Computer activities are sometimes subject to electronic vandalism. For example, a vandal or hacker may attack an Internet web server by flooding it with a torrential flow of disruptive messages that overload the server to the point of functional failure. Attacks of this kind are called “denial of service” attacks. During a denial of service attack, the vandal may fraudulently assume a number of different electronic identities, often by including messages in the disruptive flow that have a variety of source addresses. To combat such attacks, a web server may rely upon intrusion detection equipment that examines incoming messages. Such equipment detects the onslaught of a vandal's attack, reads source addresses including the addresses that the attacker usurps and fraudulently re-uses, and issues alerts upon detection of all messages that exhibit characteristics of the attack.
Computers are also subject to other kinds of attacks, for example attacks that are mounted by parties commonly known as hackers. A vandal such as a hacker may attempt to intrude upon a computer in order to steal information in an act of industrial espionage, or to implant a virus, or to alter records to the detriment or benefit of someone's interests or reputation. Again, to combat such activities, computers may be monitored and protected by intrusion detection systems.
Intrusion detection systems are effective and useful for their intended purposes. Unfortunately, however, the protected computer, the intrusion detection system, and the associated network equipment, such as firewalls and routers, are separate devices today whose operations are essentially uncoordinated. This lack of coordination limits the capability of the combined system to respond to attacks in any useful way except for detecting the presence of an attack and attempting to limit—by filtering—any damage that might result.
For example, when an intrusion detection system detects a denial of service attack upon a computer, the attack may be blocked by a firewall to the extent possible by source-address filtering. Blocking such an attack may, however, have adverse and unintended consequences. In particular, the use of protective filtering may play into the hands of a vandal who resorts to “spoofing.” A spoofer is an attacker who uses a fake source address that fraudulently identifies the spoofer as another source. Spoofing attacks may have serious consequences, for example when the spoofer usurps the source address of a web server's most important customer. In such instances, the administrators of the network of the targeted web server may unknowingly decide to filter-out all messages that bear the customer's source address, inadvertently including messages actually sent by the customer, using protective equipment such as firewalls and routers. Consequently, the web server experiences both the trauma of an attack and the adverse consequences that come with mounting a defense that filters-out legitimate messages sent by the server's most important customer. Moreover, Denial-of-Service (DoS) attacks are generally characterized by extraordinary volumes of data sent to the targeted system or network. Consequently, even if a firewall were configured to block the DoS traffic, the firewall would be quickly overwhelmed.
As the attack wears on, technicians pore over volumes of data dumped by the intrusion detection system and the network equipment, in an ad hoc attempt to determine the attack's entry point into the protected device. Unfortunately, with such an unstructured approach the entry point may not be found for several hours, during which time the intrusion detection system's filtering impedes the operation of the computer or web site under attack.
In other situations, the attack itself may be short lived, for example as in a hacker's attempt to steal information from a protected computer. By the time technicians have completed their unstructured situational analysis, the attack may be over and the hacker may have succeeded before his efforts could be blocked by filtering the computer's outbound flow of information.
Thus there is a need for an improved defense against vandals that provides a quick and efficient way of determining the entry point of an attack upon a device that is protected by an intrusion detection system, so that measures may be taken to stop the attack closer to its source or to aid in forensic investigations that follow.